Upgrade the GHA workflow to use secretless publishing

[Sviatoslav Sydorenko (Святослав Сидоренко)]

My PyPUG guide has recently been upgraded to showcase how to do this: https://packaging.python.org/en/latest/guides/publishing-package-distribution-releases-using-github-actions-ci-cd-workflows/.

[Jeff Dairiki]

I'm using the Github OpenID integration with PyPI in other projects. It's simple, requires no secrets🎉, and works well.

I'm pretty sure that I do not have sufficient PyPI permissions to configure Lektor for this. It looks like @nixjdm or @yagebu do?